Domain names are subject to various forms of abuse. These include publically defined forms such as spam, phishing, and malware as well as policy defined forms of abuse such as trademark, copyright and restricted use behaviour. Policies defining abuse come both from the Internet Corporation for Assigned Names and Numbers (ICANN), which is a regulatory body for the Internet, and a domain name registry operator, which is an entity responsible for domain names registered in a top-level domain TLD. Further, registrars, which are entities accredited to sell domain names, and registrants, who are the holders of the domain names, can also have specific policies defining abuse.
The domain registry operator is responsible for all elements of a given Top Level Domain (TLD) including who may register a domain name and what defines permitted use of the domain name. There are two basic types of TLD operator: a generic TLD (gTLD) and a country code TLD (ccTLD). The gTLD operator falls fully under ICANN's overreaching policies and a ccTLD operator operates TLDs on behalf of a given country authority. CcTLD operators are beholden to their country's policies and controls.
Domain name abuse affects TLD operators, registrars (those who resell domains) and registrants (those who hold domains), as well as countless Internet users that may have interacted with a domain name under abuse. Abuse is mitigated, by some parties, through a series of disparate tools, sources of data, custom analytics and mostly manual review and mediation by analysts. Most parties will respond to external requests to domain name abuse detected by others. The problem with this approach is that typically the greatest damage caused by domain name abuse happens within hours of its onset. Reactive mitigation, while helpful, does not alleviate the vast majority of damage caused by domain abuse.
Accordingly, a number of abuse service providers collect data about domain name abuse and provide data feeds accordingly. These abuse service providers typically offer their services through an application program interface (API), reporting mechanism, or both. They are also specialized to one or a few forms of abuse and may or may not be independently confirmed or verified, leading to a disparity in the quality and accuracy of their abuse reporting. Accordingly, it can be an expensive and complex procedure for a TLD operator, registrar or registrant to receive and process such information.
Accordingly, there is a need for a mechanism that allows TLD operators to efficiently and automatically detect and react to domain name abuse.